Security training is often seen as a boring, tedious, or even stressful task by many employees. However, it is also a crucial part of protecting your organization from cyberattacks, data breaches, and compliance violations. How can you make your security training more engaging, effective, and fun for your staff? One possible answer is gamification.
Gamification is the application of game elements and mechanics to non-game contexts, such as learning, work, or health. Gamification can help motivate people, increase their participation, enhance their retention, and reward their achievements. Some common examples of gamification are badges, points, levels, leaderboards, challenges, and feedback.
Gamification in security includes users of a product actually using the product to perform their work. Whether that is an investigation in a SOC, remediation of an endpoint, or collecting data during an incident.
Security training can benefit from gamification in several ways. First, gamification can make security training more enjoyable and interactive, which can reduce boredom, frustration, and resistance. Second, gamification can make security training more relevant and personalized, which can increase awareness, interest, and confidence. Third, gamification can make security training more measurable and rewarding, which can improve performance, feedback, and recognition.
Gamification can take out two employees’ habits when they reach the time for security training: 1) People tends to distance themselves from any “must do” task. It’s not theirs, it is the problem if the company’s and the CISO’s - so they shut all senses and wait for the end of the training. 2) Another behavior is to do everything to finish the “task”. Not listening, not participate, just get to the final Q&A exam to reach the minimal score. Gamification can take out the “boring/not mine/just another must do” feel from security training, getting people to get involved (it’s fun!).
In the security training context gamification fulfills the task of hightening the awareness and interest in possible positive and negative consequences by "simulation of real or possible security problems" by fun and/or suspense scenarios. To have a lasting effect not only taking the gamified security trainings/simulations but also the real experienced consequences and impacts should be recorded/rewarded/advertised to make the trainings purpose meaningful.
There is no one-size-fits-all approach to gamifying security training, but there are some general steps you can follow. First, you need to define your learning objectives, target audience, and desired outcomes. Second, you need to design your game elements and mechanics, such as the theme, story, rules, goals, challenges, rewards, and feedback. Third, you need to implement your game elements and mechanics, using tools, platforms, or services that suit your needs and budget. Fourth, you need to evaluate your game elements and mechanics, using data, feedback, and tests to measure their impact and effectiveness.
There are many examples of gamified security training in practice, both in-house and external. Here are some of them:
- PhishMe : A service that simulates phishing attacks and educates users on how to spot and report them. Users earn points and badges for their actions and compete with their peers.
- Cybersecurity Challenge UK : A competition that tests the skills and knowledge of aspiring cybersecurity professionals through online and live events. Participants solve puzzles, crack codes, and hack systems.
- Security Awareness Adventure : A game that teaches employees about security policies and best practices through a series of scenarios and quizzes. Users earn stars and trophies for their progress and performance.
- SecurED : A course that covers the basics of security awareness and behavior through interactive videos, animations, and games. Users earn coins and certificates for their completion and mastery.
OWASP Juice Shop is a modern and sophisticated insecure web application which can be used in web application security trainings, awareness demos, CTFs and as a guinea pig for security tools. Juice Shop encompasses vulnerabilities from the entire OWASP Top Ten along with many other security flaws found in real-world applications. World of Haiku is a popular PC game that helps players to gain real-world skills needed to become a cybersecurity professional. The game provides a cyberpunk experience that teaches various hacking related skills and tools as the players advance through the game missions.
Gamification can be a powerful tool to improve security training, but it must be used wisely and strategically. You must align your game elements and mechanics with learning objectives and outcomes, and consider the preferences, motivations, and challenges of your audience. Additionally, you should balance the challenge and the fun of the game, provide feedback and recognition, and test and iterate. If done correctly, gamification can create a more engaging, effective, and fun learning experience for staff as well as a more secure and compliant organization for stakeholders. How do you use gamification in your security training? Share your examples and tips with us.